Date: Sat, 13 Jun 2015 01:25:15 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Out of bounds read in OpenSSL function X509_cmp_time (CVE-2015-1789) and other minor issues https://blog.fuzzing-project.org/15-Out-of-bounds-read-in-OpenSSL-function-X509_cmp_time-CVE-2015-1789-and-other-minor-issues.html Lately I started an effort to systematically fuzz all possible file input vectors of OpenSSL. This led to the discovery of one potential security issue and two minor non-security fixes. Malformed inputs can cause an out of bounds heap read access in the function X509_cmp_time. This issue was reported to the OpenSSL developers on 11th March. It was independently discovered three days earlier by Google developer Robert Swiecki. During the fuzzing I also discovered several issues in the parser of ASN1 definition files. These can be used to create ASN1 data structures with OpenSSL. It is unlikely that there is any situation where ASN1 definitions are attacker controlled, therefore these are not considered security issues. The latest security updates of OpenSSL (1.0.2b, 1.0.1n, 1.0.0s, 0.9.8zg) fix all three issues. These releases also fix a number of other security issues. Shortly after publishing these updates OpenSSL issued another update (1.0.2c, 1.0.1o), because the versions contained an ABI change which should not happen in minor releases. I am aware that a couple of other people were also fuzzing OpenSSL lately. Noteworthy is one issue that was found by Joseph Birr-Pixton in the parser of elliptic curve parameters. It is an endless loop and can be used to hang processes with a high CPU load. Endless loop issues tend to get ignored because they are often false positives. https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/ It is definitely getting harder finding any new issues through fuzzing in OpenSSL. This is good news. Out of bounds read in X509_cmp_time CVE-2015-1789 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1789 Git commit / fix https://github.com/openssl/openssl/commit/f48b83b4fb7d6689584cf25f61ca63a4891f5b11 OpenSSL Security Advisory https://openssl.org/news/secadv_20150611.txt Sample malformed cert (test with openssl verify [input]) https://crashes.fuzzing-project.org/openssl-verify-oob.crt Samples for issues in ASN1 definition parser (test with openssl asn1parse -genconf [input]): Out of bounds read heap https://crashes.fuzzing-project.org/openssl-asn1-oob.asn Stack overflow through endless recursion https://crashes.fuzzing-project.org/openssl-asn1-stack.asn Uninitialized memory access https://crashes.fuzzing-project.org/openssl-asn1-uninitialized.asn -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ